Skip to main content

Researchers exploit flaws in two browsers installed on MacOS devices

Researchers recently uncovered security flaws in two web browsers for MacOS enabling hackers to gain access to Mac devices. The first flaw reared its head in Safari during the first day of Pwn2Own 2018, giving the hacker full control of the Touch Bar. Meanwhile, Check Point Research stumbled across a nasty bug in Google Chrome granting access to the administrative or any other user account without the need for a password. 

First up, Samuel “5aelo” Gross from Phoenhex targeted Safari during his Pwn2Own hack attempt using a MacOS kernel Elevation of Privileges, meaning he found a way to get permission to use resources only reserved for the lowest level of MacOS that even administrators can’t access. He did this by exploiting a bug in Safari’s Java-based just-in-time (JIT) compiler optimization combined with a flaw in the MacOS platform. 

Recommended Videos

“He used a combination of a JIT optimization bug in the browser, a macOS logic bug to escape the sandbox, and finally a kernel overwrite to execute code with a kernel extension to successfully exploit Apple Safari,” Zero Day Initiative explains a bit more thoroughly. “He left a message for us on the touchbar once he was complete.” 

Meanwhile, Check Point Research’s discovery in Google Chrome has nothing to do with the Pwn2Own 2018 event. Instead, one of the firm’s security analysts noted “unexpected behavior” while examining the Remote Desktop component of Google’s Chrome browser for MacOS. He noticed that he could sign onto the remote Mac device as a guest user, but jump into another active session, even one used by the administrator, without entering a password. 

As the report explains, typically there is someone logged onto a MacOS device but locked with a password when not in use. In turn, guests don’t actually have an account: They can simply access the Mac device without a password and are typically restricted in some fashion by the administrator. All files created by the guest are stored in a temporary folder and deleted once they log off the device. 

That said, if guests access the Mac remotely using Chrome’s extension, they see a screen displaying the current user’s password entry field and an option to sign on as a guest. After clicking on the guest icon and proceeding to the home screen, the guest will see the current user’s desktop rather than the temporary sandboxed guest account. Meanwhile, the source MacOS device displays the guest account on its screen. 

The company said it reported the Chrome issue to Google on February 15, but the search engine giant believes the Remote Desktop login screen is not “a security boundary.” Regardless, Check Point Research felt the need to go public with the issue given many Mac owners provide guest access to their devices. 

Chrome’s Remote Desktop component is a handy way to troubleshoot a remote relative’s computer or grab files from home. At least two computers need Chrome installed, with one serving as the “source” machine providing an access code to the second machine.

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
People are arguing about this classic macOS feature, and it’s hilarious
A man sitting at a desk in front of an M1 iMac. Behind him is a large glass window and a set of shelves holding books, plants and ornaments.

Moving from Windows to Mac can be confusing. Long ago, I was a lifelong Windows user before I tried my first Mac, and many of the changes were jarring and confusing. It’s often not the biggest differences that give you pause, either -- it’s the hundreds of tiny discrepancies that are just dissimilar enough to befuddle the heck out of you.

For me, one of the most perplexing changes was how much working with apps in macOS differed from Windows. “You mean I don’t need a wizard to uninstall an app?” I thought. “I can just move it to the Trash? Won't that … break something?”

Read more
I’ve been using the first macOS Sequoia public beta. Here’s my take on it so far
The iPhone Mirroring feature from macOS Sequoia being demonstrated at the Worldwide Developers Conference (WWDC) 2024.

Apple today launched the macOS Sequoia public beta, opening the doors to app developers, bug hunters, and curious users alike. With the full release not expected until much later this year, it’s a good opportunity to get a sneak peek at what Apple has in store for us.

Or at least, a sneak peek at most of what’s planned. Despite being packed with features, macOS Sequoia is missing the headline-grabbing Apple Intelligence feature, at least for the time being. Without that, is it still worth downloading and installing the public beta?

Read more
The macOS Sequoia public beta just launched. Here’s how to download it
Apple's Craig Federighi introducing the new window tiling feature in macOS Sequoia at the Worldwide Developers Conference (WWDC) 2024.

The public beta for macOS Sequoia is here, and that means anyone with a compatible device can install it and try it out -- no paid developer memberships needed. Here's how to get it.

First of all, you'll need a PC that can run macOS Sequoia. This is the list of compatible models:

Read more